Privacy policy

Who we are

MentionRex is run by [[GAP: company legal name]], [[GAP: registered address]], tax ID [[GAP: tax ID]], [[GAP: commercial registry details]] ("MentionRex", "we", "us"). We are a company in the European Union, so the EU General Data Protection Regulation (GDPR) applies to how we handle your personal data, and we are its controller.

For anything about your data, email support@mentionrex.com.

What we collect

Your account: your email address and, if you sign in with Google, the name and picture Google shares with us.

What you add: your organization's name, your brands and their websites, the competitors you follow and the questions and countries you track.

What we measure for you: the answers AI assistants and Google give to those questions, with the brands they name and the sources they cite.

Your plan: which plan you have, its status, its amounts and dates, and the identifiers Stripe gives your customer record and subscription. We never see your card number.

Technical data: your IP address and browser when you use the app, used to keep it secure, and error reports when something breaks.

Messages you send us, such as support requests.

Why we use it

To provide the service you subscribe to (our contract with you); to keep it secure, prevent abuse and understand, without cookies, how people find and use it (our legitimate interest); and to keep the records tax and accounting law requires (a legal obligation).

We don't sell your data, we don't show ads, and we don't train AI models on it.

Who processes it for us

We use a small number of providers, and each one only gets what its job needs:

Supabase: our database and sign-in, hosted in the United States (Northern Virginia).

Railway: the servers that run MentionRex, in the United States (Virginia).

Cloudflare: our domain, network delivery and protection, and the check on sign-in that you're a person (Turnstile).

AI providers (OpenAI, Anthropic, Google and Perplexity): the questions we ask about your market, which name your brand and your competitors, and their answers. They never get your email.

DataForSEO: Google's AI Overviews and AI Mode results for the same questions.

Stripe and Link: your subscription and its payments. Link (Sold through Link, LLC) sells and bills the subscription as the merchant of record: it collects your payment and billing details and issues your invoices and receipts, under its own privacy policy.

Resend: the sign-in emails.

PostHog: analytics. On mentionrex.com it counts page views without cookies; in the app, a few account events (signing up, starting checkout, the first payment and finishing setup), tied to your account's ID and never to your email.

Sentry: error reports, with emails and sign-in tokens removed.

Google: sign-in, if you choose Continue with Google.

Our data is stored in the United States. When it leaves the European Union, we rely on the safeguards the GDPR allows: the EU–US Data Privacy Framework for certified providers, or the European Commission's standard contractual clauses.

We may also share data when the law requires it, or to protect MentionRex, our users or others from fraud or abuse.

Analytics and cookies

On mentionrex.com, PostHog counts visits without cookies and without storing anything in your browser. Each visit records the page, technical details such as your browser and screen size, and, if you came from another site, only that site's domain, never the full address or your search terms. It doesn't keep your IP address, and it can't tie a visit to you or to your account.

On app.mentionrex.com, sign-in cookies keep you signed in, and mr_brand remembers the last brand you opened. A cookie called mr_in, holding only the value 1, tells mentionrex.com you're signed in, so it can show Open app. Your theme choice stays in your browser's local storage.

We use no advertising or tracking cookies.

How long we keep it

While your account is open, we keep your account, your organization, your brands and their measurements.

When you delete your account (Account → Delete account in the app), we cancel your plan and delete your sign-in, your profile, your organization's name and your brands right away. We keep a closed record of the organization with no brands, holding only ids, dates and payment records, never your email or name, because accounting law requires them and to answer payment disputes.

Link and Stripe keep their own records of your payments, under their own policies. Copies in our database backups disappear as those backups expire.

Your rights

You can delete your account yourself, at any time, from Account in the app. You can also ask for a copy of your data, ask us to correct it, delete it, limit how we use it or stop using it, or ask for it in a portable format: email support@mentionrex.com from your account's email address. We'll reply within one month.

If you think we got something wrong, you can complain to a data protection authority: the Spanish Agencia Española de Protección de Datos (aepd.es), or the one where you live.

Businesses

If your company needs a data processing agreement (DPA) with us, email support@mentionrex.com and we'll send ours.

Security

We protect your data with encryption in transit, access controls that keep each organization's data apart, and trusted providers. No system is perfectly secure; if a breach affects you, we'll tell you when the law requires it.

Age

MentionRex is only for people aged 18 or over. We don't knowingly collect data from anyone younger.

Changes

We may update this policy. The date at the top always shows the latest version, and we'll announce significant changes on this page before they take effect.